topic Re: fw ctl chain questions for the community in Firewall and Security Management

fw ctl chain questions for the community

Don_Paterson — Wed, 22 Jun 2022 15:09:09 GMT

Hello,

Considering the attached screenshot I am curious to know what members of the community have as answers to these questions or comments on the questions as they stand:

1. Can you see how the traffic flows through the kernel?

2. Besides the Firewall, what other modules are engaged?

3. Can you tell if IPS is currently deployed?

Some knowledge of the kernel is assumed but not advanced technical knowledge.

Thanks,

Don

Re: fw ctl chain questions for the community

Vladimir — Wed, 22 Jun 2022 16:30:17 GMT

Simply based on the screenshot of chains, not really.

You may see the chains enabled for a particular feature, but if the policy is configured to bypass the blade, it will not be reflected here.

You can use the fw monitor to see the traffic between specific sources and destinations through inspection points that cover most of the chain modules.

Re: fw ctl chain questions for the community

PhoneBoy — Wed, 22 Jun 2022 19:07:05 GMT

PSL is going to be active if you have any blade active above and beyond FW and VPN (e.g. IPS, App Control, URL Filtering).
enabled_blades will provide a more precise answer to 2 and 3.

Re: fw ctl chain questions for the community

Don_Paterson — Wed, 22 Jun 2022 19:19:07 GMT

Thanks.

That is true, and to see PSL (the kernel module) the command -- fw ctl debug -m | grep 'Modules' -- is a good command.

So,basically, question number 2 cannot be answered and the answer to question number 3 is No if only considering the output of the fw ctl chain command.

Regards,

Don